BSOD, broken apps and Defender ATP

Patch Tuesday update KB4517389 on released on October 8 for Windows 10 version 1903 contained security and printing fixes, but it may cause a series of problems for some users with certain configurations.

According to posts on Microsoft community forum (1, 2), Windows 10 computers are failing to boot with a Blue Screen of Death (BSOD) and the culprit appears to be cldflt.sys.

According to the findings, cldflt.sys is associated with a Cloud service, including OneDrive, iCloud and other cloud storage services. This file acts as a proxy driver for Cloud Storage providers such as OneDrive, Google Drive and Dropbox.

A potential workaround is uninstalling the aforementioned apps or removing the update altogether.

“I experienced the same BSOD with the cldflt.sys error message. I would greatly appreciate your help resolving this. I scanned my computer as a Full Scan with Windows Security. It found some adware, and blocked it, but then I ran a Quick Scan after that, and nothing was found. Hopefully that is not the issue,” a user said.

Broken apps

According to another thread, Windows 10 KB4517389 causes VBRUN300.DLL to fail, which breaks down the apps that were coded in Microsoft Visual Basic 3. Such apps would crash with an error message ‘unexpected error; quitting’.

“We are seeing the same thing with a suite of legacy 16-bit applications we support, written in VB3. We have opened a business support ticket with Microsoft about it and waiting on their product group’s response,” a user noted.

Windows 10 version 1809 patch breaks Defender ATP

A cumulative update released on October 15 for Windows 10 version 1809 breaks down Windows Defender ATP.

In a support document, Microsoft acknowledged that Defender ATP might stop running and fail to send reporting data. This bug affects enterprises and businesses that rely on Microsoft Defender ATP for Windows 10 Enterprise.

Microsoft says Windows Defender team is actively investigating the issue and a resolution will be available in mid-November.

It’s possible that the fix will ship with Patch Tuesday update and users can uninstall or delay the patch till the fix is ready.